Skip to content
MailWeave
Start free

How MailWeave works

A small, predictable pipeline between an inbox and your application.

  1. 01

    Connect an inbox

    Add any IMAP mailbox. Credentials are encrypted at rest, and you can test the connection before saving.

  2. 02

    We watch it for you

    MailWeave polls on your plan's schedule, parses each message and stores the event. Nothing is marked read until it is safely stored.

  3. 03

    Add an endpoint

    Point a webhook at your app. Each one gets its own signing secret, shown once.

  4. 04

    Receive signed JSON

    Every email arrives as a signed POST. Failures retry with backoff, then land in a dead-letter list you can replay.

What your endpoint receives

The body is compact JSON with sorted keys, exactly as signed. Verify the raw bytes before parsing.

POST your-endpoint · application/json
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "email.received",
  "data": {
    "from": { "email": "stripe-receipts@acme.co" },
    "subject": "Invoice #4821 paid",
    "text_body": "Thanks for your payment…",
    "attachments": [
      { "filename": "invoice-4821.pdf", "size": 48213 }
    ]
  }
}
Verify the signature
// MailPulse-Signature: t=1710000000,v1=9c1f…
const [t, v1] = header.split(",").map((p) => p.split("=")[1]);
if (Math.abs(Date.now() / 1000 - Number(t)) > 300) reject();

const expected = crypto
  .createHmac("sha256", secret)
  .update(`${t}.${rawBody}`)
  .digest("hex");

if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) reject();

The details

Polling
Each mailbox is checked on a schedule set by your plan, from every five minutes on Free down to every thirty seconds on Team. Only unread messages are fetched.
Parsing
Headers, text and HTML bodies and attachment metadata are extracted into one consistent event. Attachment bytes are not forwarded.
Delivery
Each endpoint receives its own signed POST. A 2xx response marks the delivery done. Anything else retries with growing delays.
Dead letters
After the final attempt a delivery is parked, not deleted. Replay it from the dashboard or the API once your endpoint is healthy.
Workspaces
Mailboxes, endpoints, members and billing live in a workspace. Invite teammates as admin, member or viewer, and issue scoped API keys for scripts.
Limits
When a monthly limit is reached, ingestion pauses and mail stays unread in your inbox. Nothing is lost, and it resumes on reset or upgrade.

Ready to see it with your own inbox?

Start free